Forest Global Training Partners

Cyber Risks · Krebs on Security

Try This One Weird Trick Russian Hackers Hate

Summary: KrebsOnSecurity reports that most ransomware strains, including DarkSide, carry a hard-coded do-not-install list covering Russia, Ukraine and other Commonwealth of Independent States countries, and will exit if a system shows a Russian or Ukrainian keyboard or language setting. DarkSide's exclusion list, published by Cybereason, reflects a practice dating to the earliest days of organized cybercrime, intended to keep affiliates from creating victims inside Russia, where authorities generally will not open a cybercrime investigation without a complaint from a victim within the country's borders.

Bottom line: Unit221B's Allison Nixon said installing a Cyrillic keyboard or setting a registry entry to 'RU' can act as a 'vaccine' against Russian malware, and that if enough people do it, Russian hackers must choose between risking their legal protections and risking income. A recent DarkSide version analyzed by Mandiant had already dropped the system language check, and Lance James of Unit221B noted that a lot of the ransomware now seen runs on virtual machines, so the VM-detection trick no longer stops it.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related